Research by CheckPoint presents a new and improved infection chain leading to the deployment of a new version of a Windows backdoor called PowerLess. Credit: ChakisAtelier / Getty Images / Clker-Free-Vector-Images Iranian state-sponsored threat actor Educated Manticore has been observed deploying an updated version of PowerLess, a Windows backdoor, to target Israel for phishing attacks, according to a new report by Check Point.Researchers have also linked Educated Maticore hackers to the Phosphorus APT group, which operates in the Middle East and North America.“The research presents a new and improved infection chain leading to the deployment of a new version of PowerLess. This implant was attributed to Phosphorus in the past,” Check Point said in its research.Phosphorus has been active since at least 2017. It has been linked to a series of campaigns in recent years, especially those wherein APT members posed as journalists and scholars to trick targets into installing malware and stealing classified information. While the PowerLess payload was similar to that deployed by Phosphorus, researchers said there have been improved toolsets used as loading methods.Educated Manticore uses .Net executablesEducated Manticore in its latest attacks was seen using .Net executables, a rarely used technique. “The actor has significantly improved its toolset, utilizing rarely seen techniques, most prominently using .Net executables constructed as Mixed Mode Assembly – a mixture of .Net and native C++ code. It improves tools’ functionality and makes the analysis of the tools to be more difficult,” Check Point said in its report.The hacking group has also started using ISO images. The ISO images used by the threat actor are in English, Arabic, and Hebrew, with academic content about Iraq. Researchers said this suggests, “the targets might have been academic researchers.”The attack chain uses Iraq-themed luresThe attack chain begins with an ISO image file that makes use of Iraq-themed lures to load a custom in-memory downloader.The ISO file claims that the academic information is from a nonprofit organization called the Arab Science and Technology Foundation. The ultimate function of the downloader is to install the PowerLess payload. “PowerLess communication to the server is Base64-encoded and encrypted after obtaining a key from the server. To mislead researchers, the threat actor actively adds three random letters at the beginning of the encoded blob,” Check Point said in its report.The use of the PowerLess payload by Phosphorus was highlighted by Cybereason in February 2022. The PowerLess payload has the capability to steal data from web browsers and apps like Telegram, take screenshots, record audio, and log keystrokes. Expect more post-infection activityResearchers have warned that the updated version of the malware can lead to more post-infection activities.“Because it is an updated version of previously reported malware, PowerLess, associated with some of Phosphorus’ Ransomware operations, it is important to note that it might only represent the early stages of infection, with significant fractions of post-infection activity yet to be seen in the wild,” Check Point said.Educated Manticore continues to evolve, refining previously observed toolsets and delivering mechanisms, Check Point said. “The actor is seen adopting popular trends to avoid detection and keeps developing custom toolsets using advanced techniques,” Check Point said in its report. Related content brandpost How an integrated platform approach improves OT security By Richard Springer Sep 26, 2023 5 mins Security news Teachers urged to enter schoolgirls into UK’s flagship cybersecurity contest CyberFirst Girls aims to introduce girls to cybersecurity, increase diversity, and address the much-maligned skills shortage in the sector. By Michael Hill Sep 26, 2023 4 mins Back to School Education Industry IT Training news CREST, IASME to deliver UK NCSC’s Cyber Incident Exercising scheme CIE scheme aims to help organisations find quality service providers that can advise and support them in practising cyber incident response plans. By Michael Hill Sep 26, 2023 3 mins IT Governance Frameworks Incident Response Data and Information Security news Baffle releases encryption solution to secure data for generative AI Solution uses the advanced encryption standard algorithm to encrypt sensitive data throughout the generative AI pipeline. By Michael Hill Sep 26, 2023 3 mins Encryption Generative AI Data and Information Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe